3 ms·
IME that doesn't work, because the un-aggregated data volumes are far too high. The whole point of using something like eBPF is that you don't need to log all t
by anarazel 4y ago
IME that doesn't work, because the un-aggregated data volumes are far too high. The whole point of using something like eBPF is that you don't need to log all that data.
- quotemstr 4y agoIs data volume too high? I don't see it. Windows and Android both collect useful traces and do post-hoc analysis on them instead of using things like eBPF stack maps to do online analysis.
- anarazel 4y agoAndroid doesn't run highly concurrent workloads, so it's not surprising that you'd not fall over. But I haven't used it, so I really can't say anything well qualified. I've only used ETW a little, but I've found it to very quickly be overwhelmed with the number of events, even on quite small machines (vm with 4 cores). I think part of our different experience comes from using profiling and tracing in different workloads. I typically profile/trace while hacking on postgres, or occasionally when debugging production issues. Commonly very busy, many core workloads. If you're interested I can collect some numbers to show the difference between collecting all the trace events for an offwake trace, and using a map. From memory, using maps reduces throughout 20-30%, full collection way way more.